fix(function-autoscaler): move TracingGuard above the test module so … #607
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: codeql | |
| on: | |
| push: | |
| branches: [main] | |
| # Only run when compiled source or this workflow changes. Docs, charts, | |
| # migrations, and other non-code PRs skip the scan (the Go autobuild is | |
| # expensive). The weekly schedule still does a full unconditional scan. | |
| paths: | |
| - "**/*.go" | |
| - "**/*.rs" | |
| - "**/*.java" | |
| - "**/go.mod" | |
| - "**/go.sum" | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| - ".github/workflows/codeql.yml" | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "**/*.go" | |
| - "**/*.rs" | |
| - "**/*.java" | |
| - "**/go.mod" | |
| - "**/go.sum" | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| - ".github/workflows/codeql.yml" | |
| schedule: | |
| # Weekly full scan, Monday 03:27 UTC. | |
| - cron: "27 3 * * 1" | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| jobs: | |
| # Decide which languages to analyze. PR policy: only buildless languages scan | |
| # pre-merge (today Rust; Java joins as build-mode none when it lands). Go is | |
| # excluded on PRs: its traced autobuild compiles the whole umbrella (~20+ min) | |
| # for advisory-only feedback (fail-on-findings is false). Go coverage comes | |
| # from every push to main and the weekly schedule, which scan everything. | |
| # Emits a dynamic matrix so no job-level `if` referencing `matrix` is needed | |
| # (that context is not allowed in a job `if`). Uses the GitHub API, not a | |
| # third-party action (org allowlist). | |
| detect: | |
| name: Detect changed languages | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| matrix: ${{ steps.f.outputs.matrix }} | |
| any: ${{ steps.f.outputs.any }} | |
| steps: | |
| - name: Detect changed languages | |
| id: f | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| go=false; rust=false; java=false | |
| files="" | |
| if [ "${{ github.event_name }}" != "pull_request" ]; then | |
| # Pushes to main and the weekly schedule scan everything, Go included. | |
| go=true; rust=true; java=true | |
| else | |
| # Never silently skip: if the changed-file lookup fails, scan both | |
| # languages instead of treating an empty result as "no code changed". | |
| if ! files="$(gh api --paginate "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --jq '.[].filename')"; then | |
| echo "::warning::changed-file lookup failed; scanning all languages" | |
| go=true; rust=true; java=true; files="" | |
| fi | |
| # gh api filenames are repo-relative with no leading slash, so anchor | |
| # manifests with (^|/) to match root and nested files alike. | |
| if printf '%s\n' "$files" | grep -qE '\.rs$|(^|/)Cargo\.(toml|lock)$'; then rust=true; fi | |
| if printf '%s\n' "$files" | grep -qE '\.java$'; then java=true; fi | |
| # A change to the scan config itself re-scans the PR-time languages. | |
| if printf '%s\n' "$files" | grep -qE '(^|/)\.github/workflows/codeql\.yml$'; then rust=true; java=true; fi | |
| fi | |
| inc="" | |
| if [ "$go" = true ]; then inc="${inc}{\"language\":\"go\",\"build-mode\":\"autobuild\"},"; fi | |
| if [ "$rust" = true ]; then inc="${inc}{\"language\":\"rust\",\"build-mode\":\"none\"},"; fi | |
| if [ "$java" = true ]; then inc="${inc}{\"language\":\"java-kotlin\",\"build-mode\":\"none\"},"; fi | |
| inc="${inc%,}" | |
| echo "matrix={\"include\":[${inc}]}" >> "$GITHUB_OUTPUT" | |
| if [ -n "$inc" ]; then echo "any=true" >> "$GITHUB_OUTPUT"; else echo "any=false" >> "$GITHUB_OUTPUT"; fi | |
| echo "selected languages: go=$go rust=$rust java=$java" | |
| analyze: | |
| name: CodeQL (${{ matrix.language }}) | |
| needs: detect | |
| if: needs.detect.outputs.any == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| # Keep one language's failure from cancelling the others. | |
| fail-fast: false | |
| # Only the languages detect selected. Go must autobuild (CodeQL 2.26 | |
| # confirmed Go does not support build-mode none); Rust uses buildless. | |
| matrix: ${{ fromJSON(needs.detect.outputs.matrix) }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| # CodeQL does not need the repo token after checkout. | |
| persist-credentials: false | |
| - name: CodeQL Analysis | |
| uses: NVIDIA/dsx-github-actions/.github/actions/codeql-scan@9a9ce3a7770a8b53d2726afa920be3276bc3ddd7 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| upload-sarif: true | |
| # Same-repository PRs can comment here. Fork PRs have a read-only token | |
| # and are handled by the companion codeql-comment.yml workflow. | |
| post-pr-comment: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }} | |
| # Non-blocking during rollout: findings surface in the Security tab and | |
| # as a PR comment, but do not gate merges yet. Tighten once triaged. | |
| fail-on-findings: false | |
| - name: Upload CodeQL results for fork PR comment | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| # The companion workflow parses this artifact as untrusted data only. | |
| name: codeql-pr-results-${{ matrix.language }} | |
| path: results/${{ matrix.language }}.sarif | |
| if-no-files-found: error | |
| retention-days: 1 | |
| - name: Prepare fork PR metadata | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && matrix.language == 'go' }} | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| mkdir -p "${RUNNER_TEMP}/codeql-pr-metadata" | |
| printf '%s\n' "$PR_NUMBER" > "${RUNNER_TEMP}/codeql-pr-metadata/pr-number" | |
| - name: Upload fork PR metadata | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && matrix.language == 'go' }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: codeql-pr-metadata | |
| path: ${{ runner.temp }}/codeql-pr-metadata/pr-number | |
| if-no-files-found: error | |
| retention-days: 1 |